Presenter

$ getent passwd bgonzalez
.
├─ name: Brandon Gonzalez
└── org: Cyber Protection Team 185 (USAR)

Experience

Brandon began his journey on the internet at 9600 baud and installed Linux the old fashioned way by compiling his own kernel. Since then, he has been bridging the gap wherever possible between mathematics, computer science and machine learning. His professional experience includes leading a startup of 40 engineers as a CTO and founding a consulting firm that specializes in high performance computing and financial forecasting. He currently works for Amazon Web Services (AWS) as a Solutions Architect supporting Army Intelligence and serves as an Operations Officer in Cyber Protection Team 185 (USAR). He holds a B.S. in Applied Mathematics and Engineering from the University of Colorado and an M.S. in Computer Science from Johns Hopkins University.

Abstract

What does an investment by a Chinese firm in a Georgia company have to do with keeping troops on the ground in Syria safe? How can we attribute exploits to the same advanced persistent threat based on timestamp ordering alone? The hypergraph can reveal how. In cybersecurity, intelligence collection and general computing, we have been stuck relying on the simple keyword string match. Users must be precise in the search term or miss out on critical matching and subsequent alerting. Even after a match is found, relationships and connections must be imputed by human or a database pivot. We present a novel way to encode information semantically - leveraging natural language processing, graph databases and vector search engines. The result is faster, more relevant, and rich search returns which can provide new insights not observed by keyword search or regular expressions. The model trains a knowledge graph and then leverages graph theory and network analysis to analyze subsequent text and compare that to entities and relationships of interest. The results are visual and semantic which can be presented to a human analyst or an automatic alerting system to take follow-on actions. This approach can benefit cybersecurity, intelligence, warfighting, and planning in both storing and recalling information.